This page lists the subprocessors that we engage to provide Velorith and that may process personal data on behalf of our customers. It forms Annex 3 of our data processing agreement. For each subprocessor we state the purpose, the data concerned, the location of processing and the mechanism on which a transfer to a third country is based.
The status column shows whether a subprocessor is already in use (live) or will be used when Velorith launches publicly (launch). Subprocessors marked as launch are covered by the general authorisation in section 6.1 of the data processing agreement. When one of them starts processing, we update its status on this page.
Infrastructure and storage
| Subprocessor | Purpose | Data | Location | Transfer mechanism | Status |
|---|---|---|---|---|---|
| Convex, Inc., San Francisco, USA | Backend database, file storage and server functions | All data stored in the service, in particular accounts, company and member data, conversations, agent runs, approvals, audit log, company brain uploads and usage records | [CONVEX_REGION] | Standard contractual clauses | Live |
| Fly.io, Inc., USA | Agent runtime with one isolated cell per member, gateway for model calls, workspaces | Conversations and model requests in transit, runtime state of agents, workspace files, commands and their output | Netherlands, Germany, France, Sweden, United Kingdom | Standard contractual clauses | Live |
| Hetzner Online GmbH, Gunzenhausen, Germany | One brain server per company, workspace servers | Company brain content (documents, retrieved links, extracted text, learnings, search index), workspace files, commands and their output | Germany, Finland | Not required, processing within the EU | Live |
| [WEB_HOST_PROVIDER] | Hosting of the website and the web app | Connection data such as IP address, requested page, browser and time, content delivered to the browser | [WEB_HOST_LOCATION] | [WEB_HOST_TRANSFER] | Launch |
| Cloudflare, Inc., San Francisco, USA | Content delivery network and web application firewall in front of the website, the app, the runtime and webhooks | Connection data and all content passing through, which Cloudflare decrypts for caching and filtering | Global network | EU-U.S. Data Privacy Framework | Launch |
AI models
All model calls go through OpenRouter. We configure agent requests so that OpenRouter forwards them only to the providers listed below for the selected model and only to providers that, according to OpenRouter's classification, do not use request data for training, and we disable automatic fallback to other providers. Requests for extracting, classifying and recognising text in company brain content also exclude providers that use request data for training, but do not fix the providers, so OpenRouter may route them to other providers that meet this condition. Embedding requests from the brain servers do not carry this setting. The model providers below receive requests from OpenRouter, not from us directly. Which models we use is described in our AI transparency information.
| Subprocessor | Purpose | Data | Location | Transfer mechanism | Status |
|---|---|---|---|---|---|
| OpenRouter, Inc., New York, USA | Routing of all model calls to the model providers | Prompts, conversation history, tool output, images, company brain content for extraction, classification, text recognition and embeddings | USA | Standard contractual clauses | Live |
| Fireworks.ai, Inc., USA | Inference for GLM 5.3 Flash via OpenRouter | Model requests and replies | USA | Onward transfer by OpenRouter under its agreement with the provider | Live |
| Together Computer, Inc., USA | Inference for GLM 5.3 Flash via OpenRouter | Model requests and replies | USA | Onward transfer by OpenRouter under its agreement with the provider | Live |
| Parasail, Inc., USA | Inference for GLM 5.3 Flash via OpenRouter | Model requests and replies | USA | Onward transfer by OpenRouter under its agreement with the provider | Live |
| Baseten Labs, Inc., San Francisco, USA | Inference for GLM 5.3 Flash via OpenRouter | Model requests and replies | USA | Onward transfer by OpenRouter under its agreement with the provider | Live |
| Other inference providers selected by OpenRouter that, according to OpenRouter's classification, do not use request data for training | Inference for GLM 5.3 Flash via OpenRouter for extracting, classifying and recognising text in company brain content | Company brain content to be processed and replies | Mostly USA, depending on the provider | Onward transfer by OpenRouter under its agreement with the provider | Live |
| Anthropic, PBC, San Francisco, USA | Inference for Claude Haiku 4.5 and Claude Sonnet 5 via OpenRouter | Model requests and replies | USA | Onward transfer by OpenRouter under its agreement with the provider | Live |
| OpenAI OpCo, LLC, San Francisco, USA | Embeddings for the company brain via OpenRouter | Text of brain content to be indexed and search queries | USA | Onward transfer by OpenRouter under its agreement with the provider | Live |
Agent tools
| Subprocessor | Purpose | Data | Location | Transfer mechanism | Status |
|---|---|---|---|---|---|
| Browser Use Inc., USA | Hosted browsers for agents with one persistent browser profile per member, live view and takeover by the member, outgoing connections through residential proxies | Pages visited by agents and their content, entries made on websites, member logins, cookies and other browsing state stored in each member's browser profile, billing metadata | Germany (EU deployment in Frankfurt), billing metadata in the USA | Standard contractual clauses | Launch |
| [TYPESAFE_ENTITY] (Jev) | Classification of planned agent actions on a member's computer before execution | Text only, namely the planned steps, the accessibility tree of the active window, the app name and the approved task | USA | Standard contractual clauses | Launch |
| Parallel Web Systems Inc., USA | Web search and extraction of page content without a browser for agents, checks of public pages for site watch triggers | Search queries, URLs and objectives sent by agents, the results and page content returned | USA | [SEARCH_API_TRANSFER] | Launch |
Communication
| Subprocessor | Purpose | Data | Location | Transfer mechanism | Status |
|---|---|---|---|---|---|
| Plus Five Five, Inc. (Resend), USA | Delivery of service emails | Recipient address, email content such as sign-in codes, invitations with company and inviter name, new sign-in alerts and spending alerts, delivery metadata | USA | EU-U.S. Data Privacy Framework | Live |
| 650 Industries, Inc. (Expo), Palo Alto, USA | Delivery of push notifications to the mobile apps | Push token, notification content such as agent name, conversation titles, the first line of a command awaiting approval and the cost or failure of a run | USA | Standard contractual clauses | Live |
| Apple Inc., Cupertino, USA | Apple Push Notification service, receives notifications from Expo for iOS devices | Push token and notification content | USA | EU-U.S. Data Privacy Framework | Live |
| Google LLC, Mountain View, USA | Firebase Cloud Messaging, receives notifications from Expo for Android devices | Push token and notification content | USA | EU-U.S. Data Privacy Framework | Live |
| [PHOTON_ENTITY] (Photon Spectrum Cloud) | iMessage line for conversations with agents | Phone number, message content and metadata | USA | Standard contractual clauses | Launch |
| Meta Platforms Ireland Limited, Dublin, Ireland | WhatsApp Business Platform for conversations with agents | Phone number, message content and metadata | Ireland, onward to Meta Platforms, Inc. in the USA | EU-U.S. Data Privacy Framework for the onward transfer to Meta Platforms, Inc. | Launch |
Payments, monitoring and analytics
| Subprocessor | Purpose | Data | Location | Transfer mechanism | Status |
|---|---|---|---|---|---|
| Stripe, Inc., South San Francisco, USA | Payment processing and customer records | Company name, owner email address, internal company reference, payment details | USA | EU-U.S. Data Privacy Framework | Live |
| Functional Software, Inc. (Sentry), San Francisco, USA | Error monitoring | Technical error information, device and browser data, pseudonymous user reference | Germany (EU data region) | EU-U.S. Data Privacy Framework | Launch |
| PostHog, Inc., San Francisco, USA | Cookieless product analytics | Usage events with pseudonymous references, no identifiers stored on the device | Germany (EU cloud) | EU-U.S. Data Privacy Framework | Launch |
Where a recipient is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR). Where we name standard contractual clauses, the clauses adopted by Commission Implementing Decision (EU) 2021/914 apply (Art. 46(2)(c) GDPR). Customers can request a copy of the relevant safeguards at [PRIVACY_EMAIL].
Not subprocessors
The following recipients are not our subprocessors. We list them so that the picture is complete.
- Services chosen by the customer. Third-party services that the customer connects, such as Slack, Telegram or Notion, websites that agents visit on a member's instruction and recipients of messages that agents send. These transfers take place on the customer's instruction
- Retrieval of submitted links. When members submit links to the company brain, our servers retrieve them directly. The operator of the linked website receives the request from our infrastructure
- Speech recognition on the device. Voice input in the mobile app is converted to text by the operating system of the device. Depending on device settings, Apple or Google may process the audio. We receive only the recognised text
- ChatGPT subscriptions. The software contains a function for connecting a member's own ChatGPT subscription. This function is not available, and no data is transmitted to OpenAI via this route
Changes to this list
We inform customers at least 30 days before we add or replace a subprocessor. We send the notice by email to the owners of each company and publish the change on this page with its effective date. The notice states the name, purpose, location and transfer mechanism of the new subprocessor.
Customers can object to a change in text form within 30 days of receiving the notice on reasonable grounds relating to data protection, by writing to [PRIVACY_EMAIL]. We will then seek a solution with the customer. If no solution is found before the change takes effect, the customer can terminate the contract or the affected part of the service in accordance with section 6.3 of the data processing agreement.
If a subprocessor has to be replaced at short notice for reasons outside our control, for example because it ceases its service or because of a security risk, we inform customers without delay. The right to object remains unaffected.
Other persons who want to receive change notices, for example a data protection officer, can subscribe at [SUBPROCESSOR_NOTICE_SUBSCRIBE].
Last updated 7 October 2026.